diff --git a/targetprocess/api.py b/targetprocess/api.py
index 24feb1b..f6229b9 100644
--- a/targetprocess/api.py
+++ b/targetprocess/api.py
@@ -83,8 +83,9 @@ class TargetProcessAPIClient(object):
     ITEMS_PER_PAGE = 20
     MAX_RETRIES = 1
 
-    def __init__(self, api_url, user, password):
+    def __init__(self, api_url, user=None, password=None, token=None):
         self.auth = HTTPBasicAuth(user, password)
+        self.token = token
         self.api_url = api_url
         self.query = {'format': 'json'}
 
@@ -174,7 +175,12 @@ def _do_request(self, method, url, **kwargs):
         attempt = kwargs.pop('attempt', 0)
         try:
             request_method = requests.__getattribute__(method)
-            response = request_method(url=url, auth=self.auth, **kwargs)
+
+            if self.token:
+                response = request_method(url=url, params={'access_token': self.token}, **kwargs)
+            else:
+                response = request_method(url=url, auth=self.auth, **kwargs)
+
             if response.status_code not in (200, 201):
                 raise BadResponseError(response=response)
 
diff --git a/tests/tests_api.py b/tests/tests_api.py
index d26d0f4..5f55e4a 100644
--- a/tests/tests_api.py
+++ b/tests/tests_api.py
@@ -7,6 +7,7 @@
 from unittest import TestCase
 
 import mock
+import requests
 from requests import ConnectionError
 
 from targetprocess.api import TargetProcessAPIClient
@@ -154,3 +155,41 @@ def test_do_request_raises_bad_response(self):
         self.method.assert_called_once_with(
             url='http://tp.api.url/api/v1/UserStories/?take=20&format=json', auth=self.api.auth
         )
+
+
+class TargetProcessAPIAuthTest(TestCase):
+    def setUp(self):
+        self.requests_get_patcher = mock.patch.object(requests, 'get', autospec=True)
+        self.requests_get_mock = self.requests_get_patcher.start()
+        self.addCleanup(self.requests_get_patcher.stop)
+
+        self.response = mock.Mock()
+        self.response.status_code = 200
+        self.requests_get_mock.return_value = self.response
+
+    def test_basic_auth(self):
+        self.api = TargetProcessAPIClient('http://tp.api.url/api/v1', 'username', 'password')
+        self.api._do_request('get', 'test_url')
+
+        self.requests_get_mock.assert_called_once_with(
+            url='test_url',
+            auth=requests.auth.HTTPBasicAuth('username', 'password'),
+        )
+
+    def test_token_auth(self):
+        self.api = TargetProcessAPIClient('http://tp.api.url/api/v1', token='my_token')
+        self.api._do_request('get', 'test_url')
+
+        self.requests_get_mock.assert_called_once_with(
+            url='test_url',
+            params={'access_token': 'my_token'},
+        )
+
+    def test_both_auth_methods_token_overrides(self):
+        self.api = TargetProcessAPIClient('http://tp.api.url/api/v1', 'username', 'password', 'my_token')
+        self.api._do_request('get', 'test_url')
+
+        self.requests_get_mock.assert_called_once_with(
+            url='test_url',
+            params={'access_token': 'my_token'},
+        )